4
votes
2answers
257 views

Provider can access my local network?

I recently talked with my ISP about many things, basically related to my (little) company security, this guy is a networking guru to me, but he did a strange thing that worries me. Basically I have a ...
2
votes
3answers
175 views

Does my account lockout policy makes sense?

I have a web-based application where users can log on with username and password. I just implemented a new account lockout feature and was wondering whether it makes sense or I totally screwed it ...
3
votes
4answers
1k views

What's the best way to secure inter-server communication for cloud servers?

I'm looking for best-practices or suggestions to secure inter-server communications between VPSs. Should I just run all traffic through SSH? What about HTTP Traffic via something like mongo? ...
1
vote
0answers
423 views

MSSQL injection convert syntax error [closed]

I just setup a test bed and i disabled information_schema from being accessed (a weak waf) and i've been trying to extract the table list from the database by using convert to spit out a conversion ...
0
votes
1answer
113 views

ensuring that compiled (and signed) packages don't contain malicious code

I would like to understand how the packaged Linux distributions (i.e. Debian) ensure that their packages don't contain any malicious code. I know that packages are signed, and that I can download the ...
2
votes
2answers
137 views

Where is the Line? [closed]

A comment posted on one of my questions the other day raised a question in my head. I know that many site admins appreciate users reporting bugs and security holes, and as a user I appreciate people ...
0
votes
1answer
484 views

HIPAA compliant on Azure cloud? [closed]

We are using WebRoles to host our api, Table storage to persist PHI and Blob Storage to persist MRIs and CT images. What is required to become HIPAA Compliant? -- Edit 2014-02-17 -- I just want to ...
2
votes
3answers
1k views

Time Memory Trade-Off Attacks

Given, we want to crack a password. With Time Memory Trade-Off Attacks one tries to find the right balance between time to compute hashes for all possible passwords. And the used memory to store all ...
0
votes
4answers
1k views

Is it bad practice to use the same password on different sites?

Is it considered bad practice to use the same password on separate sites, if so why? Even if the passwords to a site are compromised the attacker still doesn't know the user names or sites the same ...
1
vote
2answers
349 views

Security of login form

I would like to know how secure is this code I made for a login form... because I'm new in this and have serious doubts. $sql = "SELECT user_name, user_password " ."FROM users " ."WHERE ...
2
votes
2answers
398 views

Are there any logic-bombs that execute when the file is deleted?

I want to delete a suspected malicious file from a server. For the purposes of this question assume that the infected machine is Windows Server 2003 or later. Is there any risk in deleting such a ...
2
votes
1answer
125 views

Is it possible to hash bcrypt passwords more securely?

I'm wondering if it's possible to increase the work factor of an already encrypted bcrypt password. e.g. I have a password that was encrypted with a work factor of 5, is it possible to increase the ...
0
votes
1answer
50 views

Allow access only for some Mac Ids

There is an application which shows a login page. However, I do not want people to login through any machine. I want to restrict login to a few Mac Ids. Is there a way to do this? There is probably a ...
0
votes
1answer
74 views

Is encryption less resistant to brute-forcing compared to hashing?

I understand that a hashing algorithm like bcrypt uses several rounds of hashing to make it computationally expensive for a brute-force attack. How does encryption work against a brute-force attack? I ...
2
votes
2answers
208 views

Are there any known attacks for a laptop with the wifi connection turned off?

I recently got a new laptop. As I usually do, I removed the wifi module from it, since I intend to use it in public places such as my college and I don't need any sort of connectivity outside my home. ...
2
votes
2answers
186 views

Is it bad to use the same sequence of characters in each password?

A friend of mine purposed a method of making passwords where each has the same base and added to it is something indirectly related to the site or product being signed into. For example all passwords ...
2
votes
0answers
40 views

Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app? [duplicate]

Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
0
votes
5answers
218 views

Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app?

Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
0
votes
1answer
283 views

wifi devices connected even if they give a wrong password, how can i use this vulnerability

I have an access point that subscribes in the list of connected devices all the devices that try to connect to it, even if they give a wrong password. The device does not give them an IP address but ...
2
votes
2answers
1k views

How do SSL authenticated users prove authenticity through UDP packets?

I chose SSL for registration in the game client. The client communicates with the game server which stores a salted/hashed password. If I use SSL to authenticate users on login but the game does all ...
2
votes
2answers
1k views

Is IP whitelist sufficient to protect a server? [closed]

I am currently using a server 1 managing incoming traffic from users and a server 2 managing database requests from server 2. Both servers are accesible via Internet. Would IP whitelisting be a ...
3
votes
2answers
674 views

How can I recover from a hacked WordPress site and prevent future attacks?

I have a dedicated server running WordPress and have recently noticed that its been hacked and PHPShell a remote web server controller has been uploaded. This has let the hacker view and edit files ...
2
votes
3answers
199 views

Protecting wireless network

My wireless network protected under WPA-PSK/WPA2-PSK protocol. Is there a good reason to change the default user/password for the router management interface? What would it take for an hacker to ...
0
votes
1answer
196 views

MSSQL injection help [closed]

If information_schema is not allowed in MSSQL , what is another method i can use to list the tables inside a database and ultimately the columns so i can dump them without using information_schema? ...
3
votes
1answer
2k views

Do the BEAST and CRIME attacks apply to an IMAP service?

While setting up the Dovecot IMAP service, I noticed that the default parameters are not optimal, it allows SSLv3 for example. Using Thomas Pournin's TestSSLServer.java program, I saw the following: ...
4
votes
3answers
860 views

Log Attacks in Different Files using Snort

How can I log attacks separately using snort. I basically want to log attacks invoked from different files separately. Like if I have 2 files, ddos.rules and log.rules, then I want logs generated from ...
1
vote
0answers
782 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
5
votes
2answers
15k views

Why are DSA keys referred to as DSS keys when used with SSH?

When I generate a DSA key with ssh-keygen -t dsa, the resulting public key will begin with ssh-dss. How come? Why not ssh-dsa?
4
votes
3answers
277 views

Why is password strength often underestimated and uncertain in the context of password hashing?

An aspect of security has bugged me for a long time: Why is there positive certainty about the importance of hashing algorithms and salts, but password strength is either never mentioned at all or ...
-1
votes
2answers
4k views

How are client side hacks created? [closed]

Many games today are prereleased in an alpha/beta state and instantly overwhelmed by "hackers" downloading programs manipulating the game itself to become overpowered. I guess they make injections ...
7
votes
1answer
7k views

What is a Certification Path in SSL certificate?

I've been trying to learn more about Digital certificates for the past few days and I'm struggling in order to understand how actually this concept is applied in the real world. Anyways, as I visited ...
1
vote
2answers
159 views

Is Temporary XSS a Problem?

I use a site on a regular basis so I wanted to make sure it was secure. One of the things I checked was that when I changed my first name to <img src="http://blah.blah/blah/blah.notanextension" ...
13
votes
4answers
17k views

How (in)secure is POP/IMAP/SMTP

I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken: The ...
0
votes
1answer
2k views

How to use an OR condition with the content of a snort rule

I understand that if you specify multiple contents then the rule triggers only if ALL the content conditions are satisfied. But I want to create a rule that will trigger even if any one of the ...
3
votes
2answers
294 views

Why would an attacker try to guess random email usernames on a small domain?

My mail server has recently come under a very bizarre attack. Every five to ten minutes, a new IP connects to SMTP, attempts to try weird usernames (like pil, bennett, netscape, msfuser, desktop, ...
5
votes
2answers
985 views

Should IBAN and bank details be considered private data and encrypted?

To pay off our users, they are asked to enter their IBAN and bank name and bank address. The users are mostly based in Europe. As far as I know (see also this question) these details can not be used ...
0
votes
1answer
299 views

How do I solve a lot of Failure Audit (529 680) which are appearing in event viewer “Security” tab?

was trying to consume an Web Services that I have published on the Web but I couldn't thing is that when I got into the server and check the "Event Viewer" I have a LOT of "Failure Audit" and they ...
10
votes
1answer
443 views

Where does a Hyper-V guest get its entropy when generating a certificate authority key pair?

According to findings by the EFF's SSL observatory, there are "tens of thousands of keys that offer effectively no security due to weak random number generation algorithm." My understanding of that ...
3
votes
2answers
133 views

Legacy system PCI Compliance

I have a legacy system that collects and stores credit card numbers ( BAD! ). We are in the process of replacing that system in phases. We are going to integrate with a credit card processing system ...
9
votes
1answer
3k views

Does it make sense to implement OAuth when no 3rd party is involved

I own a REST API at server side and a distinct web application that would call those APIs. I want to secure my APIs calls. After some reading, I want to implement the OAuth 1.0a mechanism at server ...
0
votes
2answers
72 views

Should a user be able to change another user's role to match their own?

Lets say a web application has four user roles. Standard, Supervisor, Manager and Administrator. Should a manager be able to promote someone else to a Manager, or only to a supervisor? I realize in ...
2
votes
1answer
8k views

How do I use nmap to scan a range of IPv6 addresses? [closed]

I need to scan a range of IPv6 addresses with Nmap, but I'm not sure how to do this. When scanning for an IPv4 range, I would usually do this: nmap -sP 192.168.*.* or nmap -sP 192.168.1.* but if ...
1
vote
0answers
2k views

Want to implement a really good authentication mechanism for REST API

I own a web application (single page application with Angular), that asks for some data through a set of REST APIs based on my server-side application (using Play Framework 2.2.1). So basically, I'm ...
2
votes
1answer
210 views

How to configure Kismet to redetect same BSSIDs in a loop?

So I am working on a tool to detect any wifi device using Kismet. When I use Kismet, it works fine, but my problem is, it detects a device once, and until the MAC changes, it wont detect it again. ...
1
vote
1answer
992 views

Pgp Private key storage on windows server advice

Looking for a bit of advice really, here's the situation: I currently have a security minded client who will be sending PGP encrypted files. I have to decrypt the files on my server before ...
0
votes
1answer
139 views

Is it useful to use 'dot' and 'at' in email addresses in documents on the web? [duplicate]

My question seems to be a mash up of two questions. The first is that over at TeX.SE there is a question about creating PDFs with crawler resistant email addresses. There are some good answers about ...
1
vote
4answers
147 views

Why pull upgrade from production server rather pushing them from development server?

I am reading a book on security which suggest that if you have both development and production server and if you make some change, you should pull them from production server rather pushing them from ...
-2
votes
2answers
345 views

Trojan TCP and UDP ports removal solution?

After a nmap scan on my local host on my Windows 7 machine results showed a vast list of open ports. I'm using Windows Firewall. This machine was given to me by a friend. I've had my network crash ...
2
votes
0answers
474 views

What causes wifi network connections to timeout? [closed]

i was wondering what actually causes wifi network connections to timeout. for instance, say my laptop is connected to my wifi and i yank the battery out such that my laptop can't send any proper ...
0
votes
1answer
227 views

Key Management in Interception Proxies?

I'm reading Jarmoc's Black Hat presentation on SSL/TLS Interception Proxies and Transitive Trust. I have a few questions on some of the key management practices. In the paper, Jarmoc states: To ...

15 30 50 per page